RHSA-2026:6912HighCVSS 9.1

Red Hat Security Advisory: Red Hat Quay 3.10.20

Published
April 7, 2026
Last Modified
August 24, 2026

🔗 CVE IDs covered (7)

CVE-2026-4599 →CVE-2026-4600 →CVE-2026-4601 →CVE-2026-4602 →CVE-2026-28498 →CVE-2026-30922 →CVE-2026-32597 →

📋 Description

CVE-2026-4599 — jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces CVE-2026-4600 — jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters CVE-2026-4601 — jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing CVE-2026-4602 — jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling CVE-2026-28498 — authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens CVE-2026-30922 — pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion CVE-2026-32597 — pyjwt: PyJWT accepts unknown crit header extensions (RFC 7515 §4.1.11 MUST violation)

🎯 Affected products17

  • Red Hat Quay 3.1
  • registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64 as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x as a component of Red Hat Quay 3.1
  • registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64 as a component of Red Hat Quay 3.1

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (10)